Download Full Version CGEIT Isaca Exam

IT principles and policies are the documents that best reflect the ethical values adopted by an IT organization. IT principles are the high-level statements that express the fundamental beliefs and values of the organization regarding the use and management of IT. IT policies are the specific rules and guidelines that implement the IT principles and ensure compliance with ethical standards and regulations. IT principles and policies help to align IT with business objectives, foster a culture of trust and responsibility, and promote good governance practices. References := CGEIT Exam Content Outline, Domain 1: Governance of Enterprise IT, Subtopic A: Governance Framework, Task 2: Ensure that a framework is in place to support the alignment of IT with enterprise objectives, enabling value creation. Ethics for IT Professionals/Professional Code of Ethics, Ethical Code section. Values and Ethics in Information Systems, Introduction section. Purpose, Ethical Values, Culture and Behaviours, Ethical Values section.

Before implementing an information architecture that restricts access to data based on sensitivity, the enterprise must establish the classification and ownership of the data. Classification is the process of tagging data according to its type, sensitivity, and value to the organization if altered, stolen, or destroyed. It helps the organization understand the risk and impact of data breaches and comply with relevant regulations. Ownership is the process of assigning roles and responsibilities for data creation, maintenance, protection, and disposal. It helps the organization ensure accountability and governance of data throughout its lifecycle

Incident severity and downtime trend analysis is the most important result to report to the CIO to measure progress in improving system availability to mitigate IT risk to the business, because it directly reflects the impact and frequency of system failures or disruptions on the business operations, processes, and functions. By analyzing the severity and duration of incidents over time, the CIO can evaluate the effectiveness of the IT risk management and system availability strategies, and identify any gaps, issues, or opportunities for improvement. Incident severity and downtime trend analysis can also help the CIO to communicate the value and performance of the IT risk management and system availability initiatives to the business stakeholders, and justify any further investment or action required to achieve the desired outcomes.

The other options are not as important as incident severity and downtime trend analysis, because they are either too indirect or too subjective to measure progress in improving system availability to mitigate IT risk to the business. Probability and severity of each IT risk is a useful input for IT risk management, but it does not necessarily reflect the actual occurrence or impact of system failures or disruptions on the business1. Financial losses and bad press releases are possible consequences of system failures or disruptions, but they may not capture the full extent or root causes of the IT risk to the business2. Customer and stakeholder complaints over time are indicators of customer satisfaction and loyalty, but they may not be reliable or consistent measures of system availability or IT risk to the business

The board of directors is ultimately responsible for the governance of IT and ensuring that IT supports the enterprise’s objectives and strategy. The board of directors should also oversee the implementation and monitoring of IT governance controls to ensure compliance with laws and regulations. References: ISACA, CGEIT Review Manual, 7th Edition, 2019, page 17.